[ragaumon]

---

type: dependency
scope: package.json, package-lock.json
risk_level: low
ticket_id: OGSEC-188
breaking_change: false

Semantic Intent

Context: Aikido reports two critical findings against tinypool 1.1.0, pulled in only by docusaurus/core 3.10.2 (^1.0.2). No stable Docusaurus 3.x release moves to tinypool 2.
Objective: Force tinypool to 2.2.0 (>= 2.1.1) with an npm override until the site moves to Docusaurus 4.
Out of scope: docusaurus.config.ts, sidebars.ts, src/, docs/, blog/, changelog/, static/ and .github/workflows/. No other dependency gets an upgrade, a new override or a removal. The Docusaurus version stays at 3.10.2. The issue's description, title, aikido_* metadata and status belong to aikido-sync, and nothing suppresses the Aikido findings.

Architectural Impact

• Dependencies: overrides gains tinypool: ^2.1.1; the lockfile changes only the tinypool entry (1.1.0 to 2.2.0).
• Configuration / deployment: nothing else changed. Node range unchanged (>=20.0).

Security & Edge Cases Handled

• Removes the vulnerable tinypool version from the dependency tree.
• Docusaurus loads tinypool only when future.faster.ssgWorkerThreads is on (off here); a forced pool build was run to cover that path.

Verification Protocol

Suites run: npm ci + npm ls tinypool pass (core -> tinypool@2.2.0); npm run build passes on Node 24; npm run test:format passes; forced pool build (temporary, reverted config edit) passes with "Create SSG thread pool - 2 threads". Not run: fresh Aikido scan (post-merge).
Review focus: the lockfile diff is one package entry. Remove the override once Docusaurus 4 is adopted.